fix(branch): honor --gate-review in gx branch finish

[NagyVikt]

Problem

gx branch finish passed its argv straight to agent-branch-finish.sh via invokePackageAsset, bypassing src/finish/index.js where runReviewGate lives. Two consequences:

1. The shell script exits 1 on the unknown --gate-review argument.
2. Its --via-pr path calls gh pr merge --squash unconditionally right after opening the PR (agent-branch-finish.sh:1267), before the wait/auto fallbacks — i.e. it merges fail-open.

So the workflow every repo's CLAUDE.md documents as the default could never gate, and merged without one. review-gate.js's own header already noted this ("can fail open (it merged PR #610 to main with red preflight tests)") — the gate existed, but only gx ship / gx finish ever ran it.

This is the gap that let lifted.sk-storefront PR #298 merge to production with its review check skipped.

Change

• Split the gx-level gate flags out of the script's argv and run runReviewGate before invoking the script. It throws on a dirty review, red CI, or a PR GitHub will not merge, so the script — and the merge — never runs.
• Unrelated flags (--auto-resolve, --no-preflight, …) still reach the script untouched.
• Resolve the gated base with resolveFinishBaseBranch, matching how the shell resolves an omitted --base (per-branch branch.<name>.guardexBase). Resolving it differently would review one base and merge into another.

Verification

• test/branch-gate-review.test.js (8 tests): gate runs, flag stripped, fail-closed (a throwing gate never invokes the script), opt-outs, HEAD fallback, per-branch base, inline --branch=/--base=, and a byte-for-byte passthrough guard for callers without the flag.
• All 8 fail against the pre-fix branch.js.
• Full suite: 763 pass / 27 fail, 0 new failures vs the main baseline (this repo is baseline-red; the failing set is byte-identical).
• Verified live: running the fixed gx branch finish --gate-review on a storefront branch refused to merge when the review provider errored — "Refusing to merge."

Known follow-ups (from review, not blocking)

• options: {} hard-codes provider codex + requireChecks; --review-provider / --allow-no-checks are not parsed on this path and would reach the shell as unknown args.
• GUARDEX_AUTO_SHIP=1 does not enable the gate here, though args.js documents that it should.

🤖 Generated with Claude Code